Setup Secrets Store CSI Driver on Azure RedHat OpenShift (ARO)

How to setup Azure Keyvault Provider for Secrets Store CSI Driver on Azure RedHat OpenShift (ARO)

Installation

  1. Install the Azure Keyvault provider for Secrets Store CSI Driver on Azure RedHat OpenShift run:

    helm repo add csi-secrets-store-provider-azure https://raw.githubusercontent.com/Azure/secrets-store-csi-driver-provider-azure/master/charts
    helm install csi csi-secrets-store-provider-azure/csi-secrets-store-provider-azure --set linux.privileged=true
    

    Setting linux.privileged=true with helm install will enable privileged mode for the Linux daemonset pods.

        securityContext:
          privileged: true
    

    This is required for the AKV provider pods to successfully startup in ARO.

  2. Bind SecurityContextConstraints (SCC) to the Secrets Store CSI Driver and Azure Keyvault Provider service accounts

    # Replace $target_namespace with the namespace used for helm install
    # Secrets Store CSI Driver service account
    oc adm policy add-scc-to-user privileged system:serviceaccount:$target_namespace:secrets-store-csi-driver
    # Azure Keyvault Provider service account
    oc adm policy add-scc-to-user privileged system:serviceaccount:$target_namespace:csi-secrets-store-provider-azure
    

Uninstall

  1. Run the following command to uninstall

    helm delete <release name>
    
  2. Remove the SCC bindings

    # Replace $target_namespace with the namespace used for helm install
    oc adm policy remove-scc-to-user privileged system:serviceaccount:$target_namespace:secrets-store-csi-driver
    oc adm policy remove-scc-to-user privileged system:serviceaccount:$target_namespace:csi-secrets-store-provider-azure